


base_path=$(cd `dirname $0`;pwd)
parentHome=$(cd `readlink -f  $base_path/../`;pwd)


kubernetesServerBin=$(cd `readlink -f $parentHome/../kubernetes/kubernetes-server/server/bin`;pwd)

kubernetesNodeBin=$(cd `readlink -f $parentHome/../kubernetes/kubernetes-node/node/bin`;pwd)

kubernetesClientBin=$(cd `readlink -f $parentHome/../kubernetes/kubernetes-client/client/bin`;pwd)


etcdBin=$(cd `readlink -f $parentHome/../etcd-v3.3.10-linux-amd64`;pwd)

flannelBin=$(cd `readlink -f $parentHome/../flannel`;pwd)


environmentFile="environment.bashrc"

echo "#配置环境变量" > $environmentFile

sslHome="$parentHome/etc/kubernetes/ssl"
tokenHome="$parentHome/etc/kubernetes/token"
kubernetesConfigHome="$parentHome/etc/kubernetes"
kubeconfigHome="$kubernetesConfigHome/kubeconfig"

genServiceHome="$parentHome/service"

for dir in $sslHome $tokenHome $kubernetesConfigHome $kubeconfigHome $genServiceHome 
do
    if [ ! -d $dir ]; then
    
        mkdir -p "$dir"        
    
    fi

done

#ln -s "$parentHome"/ext_bin/cfssl-certinfo_linux-amd64 /bin/cfssl-certinfo
#ln -s "$parentHome"/ext_bin/cfssljson_linux-amd64 /bin/cfssljson
#ln -s "$parentHome"/ext_bin/cfssl_linux-amd64 /bin/cfssl
#
cmd_cfssl_certinfo="$parentHome"/ext_bin/cfssl-certinfo_linux-amd64
cmd_cfssljson="$parentHome"/ext_bin/cfssljson_linux-amd64
cmd_cfssl="$parentHome"/ext_bin/cfssl_linux-amd64




#生成bootstrap token
bootStrapToken=$(head -c 16 /dev/urandom | od -An -t x | tr -d ' ')

echo "${bootStrapToken},kubelet-bootstrap,10001,\"system:kubelet-bootstrap\"" > $tokenHome/token.cvs

echo "BOOTSTRAP_TOKEN=\"$bootStrapToken\"" >> $environmentFile
echo "export K8_TOKEN_HOME=$tokenHome" >> $environmentFile

#生成相关证书文件
certConfigHome="template/etc/conf"
#生成ca根证书
$cmd_cfssl gencert -initca "${certConfigHome}/ca-csr.json" | $cmd_cfssljson -bare "${sslHome}/ca"

$cmd_cfssl gencert -ca=${sslHome}/ca.pem \
    -ca-key=${sslHome}/ca-key.pem \
    -config=${certConfigHome}/ca-config.json \
    -profile=peer $certConfigHome/kube-proxy-csr.json \
    | cmd_cfssljson -bare $sslHome/kube-proxy

$cmd_cfssl gencert -ca=${sslHome}/ca.pem \
    -ca-key=${sslHome}/ca-key.pem \
    -config=${certConfigHome}/ca-config.json \
    -profile=peer $certConfigHome/server-csr.json \
    | cmd_cfssljson -bare $sslHome/server


$cmd_cfssl gencert -ca=${sslHome}/ca.pem \
    -ca-key=${sslHome}/ca-key.pem \
    -config=${certConfigHome}/ca-config.json \
    -profile=peer $certConfigHome/client-csr.json \
    | $cmd_cfssljson -bare $sslHome/client






echo "export K8_CERT_HOME=$sslHome" >> $environmentFile




kubeApiServer="https://10.2.238.250:6443"

#创建kubelet bootstrap.kubeconfig文件

#设置集群参数.执行该命令将会生成bootstrap.kubeconfig文件
kubectl config set-cluster kubernetes \
    --certificate-authority=$sslHome/ca.pem \
    --embed-certs=true \
    --server=$kubeApiServer \
    --kubeconfig=$kubeconfigHome/bootstrap.kubeconfig

#设置客户端认证参数,在指定的kubeconfig配置文件中添加users->user->token值
kubectl config set-credentials kubelete-bootstrap \
    --token=${bootStrapToken} \
    --kubeconfig=$kubeconfigHome/bootstrap.kubeconfig


#设置上下文参数,在指定配置文件中contexts域增加指定属性
kubectl config set-context default \
    --cluster=kubernetes \
    --user=kubelet-bootstrap \
    --kubeconfig=$kubeconfigHome/bootstrap.kubeconfig


#设置默认上下文.设置谁的默认上下文？kube-apiserver? kubelet ? or kube-controller-manager?
kubectl config use-context default --kubeconfig=$kubeconfigHome/bootstrap.kubeconfig

   

#创建kube-proxy kubeconfig文件

#设置集群参数.执行该命令将会生成kube-proxy.kubeconfig文件
kubectl config set-cluster kubernetes \
    --certificate-authority=$sslHome/ca.pem \
    --embed-certs=true \
    --server=$kubeApiServer \
    --kubeconfig=$kubeconfigHome/kube-proxy.kubeconfig

#设置客户端认证参数,在指定的kubeconfig配置文件中添加users->user->token值
kubectl config set-credentials kubelete-bootstrap \
    --client-certificate=$sslHome/kube-proxy.pem \
    --client-key=$sslHome/kube-proxy-key.pem \
    --embed-certs=true \
    --kubeconfig=$kubeconfigHome/kube-proxy.kubeconfig

#设置上下文参数,在指定配置文件中contexts域增加指定属性
kubectl config set-context default \
    --cluster=kubernetes \
    --user=kube-proxy \
    --kubeconfig=$kubeconfigHome/kube-proxy.kubeconfig


#设置默认上下文.设置谁的默认上下文？kube-apiserver? kubelet ? or kube-controller-manager?
#该命令会修改配置文件项current-context值为default，其原值为""。
kubectl config use-context default --kubeconfig=$kubeconfigHome/kube-proxy.kubeconfig

 


#生成api-server的配置
masterAddress=${1:-"10.2.238.250"}
etcdServers=${2:-"http://127.0.0.1:2379"}
cat <<EOF > $kubernetesConfigHome/kube-apiserver

KUBE_APISERVER_OPTS=" \\
    --logtostderr=true \\
    --v=4 \\
    --etcd-servers=$etcdServers \\
    --insecure-port=8080 \\
    --secure-port=6443 \\
    --advertise-address=$masterAddress \\
    --allow-privileged=true \\
    --service-cluster-ip-range=10.10.10.0/24 \\
    --admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota,NodeRestriction \\
    --authorization-mode=RBAC,Node \\
    --kubelet-https=true \\
    --enable-bootstrap-token-auth \\
    --token-auth-file=$tokenHome/token.csv \\
    --service-node-port-range=30000-50000 \\
    --tls-cert-file=$sslHome/server.pem \\
    --tls-private-key-file=$sslHome/server-key.pem \\
    --client-ca-file=$sslHome/ca.pem \\
    --service-account-key-file=$sslHome/ca-key.pem \\
    --etcd-cafile=$sslHome/ca.pem \\
    --etcd-certfile=$sslHome/server.pem \\
    --etcd-keyfile=$sslHome/server-key.pem"
    



EOF

#api-server服务配置
cat <<EOF > $genServiceHome/kube-apiserver.service

[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=$kubernetesConfigHome/kube-apiserver
ExecStart=$kubernetesServerBin/kube-apiserver \$KUBE_APISERVER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target

EOF


#kube-controller-manager配置

cat <<EOF > $kubernetesConfigHome/kube-controller-manager
KUBE_CONTROLLER_MANAGER_OPTS=" \\
    logtostderr=true \\
    --v=4 \\
    --master=${masterAddress}:8080 \\
    --leader-elect=true \\
    --address=127.0.0.1 \\
    --service-cluster-ip-range=10.10.10.0/24 \\
    --cluster-signing-cert-file=$sslHome/ca.pem \\
    --cluster-signing-key-file=$sslHome/ca-key.pem \\
    --service-account-private-key-file=$sslHome/ca-key.pem \\
    --root-ca-file=$sslHome/ca.pem"

EOF
#kube-controller-manager服务配置
echo "kube-controller-manger.service:$genServiceHome/kube-controller-manager.service"
cat <<EOF > $genServiceHome/kube-controller-manager.service
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=$kubernetesConfigHome/kube-controller-manager
ExecStart=$kubernetesServerBin/kube-controller-manager \$KUBE_CONTROLLER_MANAGER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF


#kube-sheduler配置
cat <<EOF > $kubernetesConfigHome/kube-scheduler
KUBE_SCHEDULER_OPTS=" \\
    --logtostderr=true \\
    --v=4 \\
    --master=$masterAddress:8080 \\
    --leader-elect "

EOF

#kube-scheduler 服务配置

cat <<EOF > $genServiceHome/kube-scheduler.service
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/kubernetes/kubernetes
[Service]
EnvironmentFile=$kubernetesConfigHome/kube-scheduler
ExecStart=$kubernetesServerBin/kube-scheduler \$KUBE_SCHEDULER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

















echo "genConfig end!"
service_home="/lib/systemd/system"


k8_master="${parentHome}/k8_master.sh"


echo "#k8 master run " > $k8_master

chmod +x $k8_master

#copy service script to system folder

echo "#copy service script to system folder " >> $k8_master

echo "cp -f service/etcd.service $service_home/ " >> $k8_master
echo "cp -f service/kube-apiserver.service $service_home/ " >> $k8_master
echo "cp -f service/kube-controller-manager.service $service_home/ " >> $k8_master
echo "cp -f service/kube-scheduler.service $service_home/ " >> $k8_master

echo "#load service" >> $k8_master
echo "systemctl daemon-reload " >> $k8_master

#enable servivce

mkdir -p /var/lib/etcd

echo "#enable service" >> $k8_master
echo "systemctl enable etcd " >> $k8_master
echo "systemctl enable kube-apiserver " >> $k8_master
echo "systemctl enable kube-controller-manager " >> $k8_master
echo "systemctl enable kube-scheduler " >> $k8_master


#stop service
echo "#stop service " >> $k8_master
echo "systemctl stop etcd " >> $k8_master
echo "systemctl stop kube-apiserver " >> $k8_master
echo "systemctl stop kube-controller-manager " >> $k8_master
echo "systemctl stop kube-scheduler " >> $k8_master


#start service
echo "#start service " >> $k8_master
echo "systemctl start etcd " >> $k8_master
echo "systemctl start kube-apiserver " >> $k8_master
echo "systemctl start kube-controller-manager " >> $k8_master
echo "systemctl start kube-scheduler " >> $k8_master

echo "#因为是双向证书认证，docker节点在请求的时候需要向master节点认证并颁发证书" >> $k8_master
echo "#那就需要授于相关权限，以下便是授权操作" >> $k8_master
echo "$kubernetesClientBin/kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap" >> $k8_master




nodeAddress=${1:-"10.2.238.250"}
dnsServerIP=${2:-"10.10.10.2"}

#生成kubelet配置
cat <<EOF > $kubernetesConfigHome/kubelet
KUBELET_OPTS="--logtostderr=true \\
--v=4 \\
--address=${nodeAddress} \\
--hostname-override=${nodeAddress} \\
--kubeconfig=$kubeconfigHome/kubelet.kubeconfig \\
--experimental-bootstrap-kubeconfig=$kubeconfigHome/bootstrap.kubeconfig \\
--cert-dir=$sslHome \\
--allow-privileged=true \\
--cluster-dns=${dnsServerIP} \\
--cluster-domain=cluster.local \\
--fail-swap-on=false \\
--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"

EOF

#生成kubelet服务配置
cat <<EOF > $genServiceHome/kubelet.service
[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service

[Service]
EnvironmentFile=$kubernetesConfigHome/kubelet
ExecStart=$kubernetesNodeBin/kubelet \$KUBELET_OPTS
Restart=on-failure
KillMode=process

[Install]
WantedBy=multi-user.target
EOF


#生成kube-proxy配置
cat <<EOF > $kubernetesConfigHome/kube-proxy
KUBE_PROXY_OPTS="--logtostderr=true \
    --v=4 \
    --hostname-override=${nodeAddress} \
    --kubeconfig=$kubeconfigHome/kube-proxy.kubeconfig"

EOF

#生成kube-proxy服务配置
cat <<EOF > $genServiceHome/kube-proxy.service
[Unit]
Description=Kubernetes Proxy
After=network.target

[Service]
EnvironmentFile=$kubernetesConfigHome/kube-proxy
ExecStart=$kubernetesNodeBin/kube-proxy \$KUBE_PROXY_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF


#flannel配置文件
etcdEndPoints=${1:-"http://127.0.0.1:2379"}
cat <<EOF > $kubernetesConfigHome/flanneld
FLANNEL_OPTIONS="--etcd-endpoints=${etcdEndPoints} \
    -etcd-cafile=$sslHome/ca.pem \
    -etcd-certfile=$sslHome/server.pem \
    -etcd-keyfile=$sslHome/server-key.pem"

EOF

#生成flannel的服务配置文件
cat <<EOF > $genServiceHome/flanneld.service
[Unit]
Description=Flanneld overlay address etcd agent
After=network-online.target network.target
Before=docker.service

[Service]
Type=notify
EnvironmentFile=$kubernetesConfigHome/flanneld
ExecStart=$flannelBin/flanneld --ip-masq \$FLANNEL_OPTIONS
ExecStartPost=$flannelBin/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/subnet.env
Restart=on-failure

[Install]
WantedBy=multi-user.target

EOF

#etcd配置文件
cat > $kubernetesConfigHome/etcd <<EOF
#[Member]
ETCD_NAME="etcd01"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://10.2.238.250:2380"
ETCD_LISTEN_CLIENT_URLS="https://10.2.238.250:2379"

#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.2.238.250:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://10.2.238.250:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://10.2.238.250:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
EOF
#etcd 服务配置文件
cat > $genServiceHome/etcd.service <<EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
EnvironmentFile=$kubernetesConfigHome/etcd
#    --initial-cluster=\${ETCD_INITIAL_CLUSTER} \
#    --initial-cluster-token=\${ETCD_INITIAL_CLUSTER} \
#    --initial-cluster-state=new \
#
ExecStart=$etcdBin/etcd \
    --name=\${ETCD_NAME} \
    --data-dir=\${ETCD_DATA_DIR} \
    --listen-peer-urls=\${ETCD_LISTEN_PEER_URLS} \
    --listen-client-urls=\${ETCD_LISTEN_CLIENT_URLS},http://127.0.0.1:2379 \
    --advertise-client-urls=\${ETCD_ADVERTISE_CLIENT_URLS} \
    --initial-advertise-peer-urls=\${ETCD_INITIAL_ADVERTISE_PEER_URLS} \
    --cert-file=$sslHome/server.pem \
    --key-file=$sslHome/server-key.pem \
    --peer-cert-file=$sslHome/server.pem \
    --peer-key-file=$sslHome/server-key.pem \
    --trusted-ca-file=$sslHome/ca.pem \
    --peer-trusted-ca-file=$sslHome/ca.pem
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF
#要想使用flannel需要在etcd中新建flannel的网络信息
echo "$etcdBin/etcdctl --endpoints=\"http://127.0.0.1:2379,http://127.0.0.1:4001,http://10.2.238.250:2379\"  \
    mk /coreos.com/network/config \
    '{\"Network\":\"192.168.0.0/16\",\"Backend\":{\"Type\": \"vxlan\"}}' " >> $k8_master



k8_node="$parentHome/k8_node.sh"


echo "#K8 node run script " > $k8_node

chmod +x $k8_node

# copy service script to system folder
echo "#copy service script to system folder " >> $k8_node
echo "cp -f service/flanneld.service $service_home/ " >> $k8_node
echo "cp -f service/kube-proxy.service $service_home/ " >> $k8_node
echo "cp -f service/kubelet.service $service_home/ " >> $k8_node

cat <<EOF >> $k8_node
docker_service="$service_home/docker.service"
if [ -f "\$docker_service" ]; then
    dockerServer=$(which dockerd)
    sed -i 's/flanneld.service //g' \$docker_service
    sed -i 's/^After\=/After\=flanneld\.service /g' \$docker_service
    sed -i '/flannel\/docker/d' \$docker_service
    sed -i '/run\/flannel/d' \$docker_service
    sed -i "s/^ExecStart/#ExecStart/g" \$docker_service
    sed -i '/^#ExecStart/i\EnvironmentFile=\/run\/flannel\/subnet.evn' \$docker_service
    sed -i '/^#ExecStart/i\EnvironmentFile=\/run\/flannel\/docker' \$docker_service
    sed -i "/var\/run\/docker/d" \$docker_service
    sed -i '/^#ExecStart/a\ExecStart='\$dockerServer' -H fd:// -H unix:///var/run/docker.sock \$DOCKER_OPTS \$DOCKER_NET_WORK_OPTIONS' \$docker_service
else
    echo "please install docker ,and enable docker.service,then rerun this script .or insert EnvironmentFile=-/run/flannel/docker for manual"
fi
EOF

echo "#load service" >> $k8_node
echo "systemctl daemon-reload " >> $k8_node


# eanble service


echo "mkdir -p /var/lib/kubelet" >> $k8_node

echo "#enable service" >> $k8_node
echo "systemctl enable flanneld " >> $k8_node
echo "systemctl enable kube-proxy " >> $k8_node
echo "systemctl enable kubelet " >> $k8_node


#stop service

echo "#stop service " >> $k8_node
echo "systemctl stop docker " >> $k8_node
echo "systemctl stop flanneld " >> $k8_node
echo "systemctl stop kube-proxy " >> $k8_node
echo "systemctl stop kubelet    " >> $k8_node

#关闭交换分区
#临时关闭
#echo "swapoff -a   " >> $k8_node


#尽量不使用交换分区，注意，在此不是禁用
#临时生效
#echo "sysctl -w vm.swappiness=0 " >> $k8_node
#永久生效
#echo "vm.swappiness = 0">> /etc/sysctl.conf 

#或者在kubelet启动参数中设置--fail-swap-on=false

#start service

echo "#start service " >> $k8_node
echo "systemctl start flanneld " >> $k8_node
echo "systemctl start kube-proxy " >> $k8_node
echo "systemctl start kubelet    " >> $k8_node

echo "systemctl start docker " >> $k8_node



